@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.339.0

package/dist/tags/feature.d.ts

@@ -28,9 +28,10 @@ export type TagsFeatureOptions = {
      *  `tag-assignment`; the `tag` catalog stays tenant-wide by design.
      *
      *  `ownership.write` is separate and does NOT affect list/read. It's
-     *  consulted by the framework's generic delete/forget/restore paths (not by
-     *  this feature's own assign-tag handler — see createTagsFeature's
-     *  boot-guard comment). A `from()` rule there also gates GDPR erasure
+     *  consulted on every assignment write: assign-tag (create/restore),
+     *  remove-tag (delete) and the framework's generic forget path. The
+     *  delete-tag cascade stays ungated, since deleting a catalog tag detaches
+     *  it everywhere. A `from()` rule there also gates GDPR erasure
      *  (`forget`): if the rule's role map doesn't cover whatever role the
      *  erasure/retention pipeline runs as, `forget` denies instead of
      *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make

package/dist/tags/feature.js

@@ -21,6 +21,7 @@ import { defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateH
 import { hasWhereRule } from "../shared/index.js";
 import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
+import { createTagAssignmentExecutor } from "./executor.js";
 import { createAssignTagHandler } from "./handlers/assign-tag.write.js";
 import { createCreateTagHandler } from "./handlers/create-tag.write.js";
 import { createDeleteTagHandler } from "./handlers/delete-tag.write.js";
@@ -45,8 +46,9 @@ function registerTags(r, access, toggleable, ownership, parents) {
     r.writeHandler(createCreateTagHandler(access));
     r.writeHandler(createUpdateTagHandler(access));
     r.writeHandler(createDeleteTagHandler(access));
-    r.writeHandler(createAssignTagHandler(access));
-    r.writeHandler(createRemoveTagHandler(access));
+    const assignmentExecutor = createTagAssignmentExecutor(ownership);
+    r.writeHandler(createAssignTagHandler(access, assignmentExecutor));
+    r.writeHandler(createRemoveTagHandler(access, assignmentExecutor));
     // Convention aliases for entityList/entityEdit — create stays flat-payload
     // (payloadMode=values); update must accept the {id,version,changes} envelope
     // entityEdit sends (legacy update-tag stays for TagManager). delete stays

package/dist/tags/handlers/assign-tag.write.d.ts

@@ -1,3 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createAssignTagHandler(access?: AccessRule): WriteHandlerDef;
+import { tagAssignmentExecutor } from "../executor.js";
+export declare function createAssignTagHandler(access?: AccessRule, assignmentExecutor?: typeof tagAssignmentExecutor): WriteHandlerDef;
 export declare const assignTagHandler: WriteHandlerDef;

package/dist/tags/handlers/assign-tag.write.js

@@ -25,7 +25,7 @@ import { assignTagPayloadSchema } from "../schemas.js";
 // the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
 // without the check any dispatch-eligible tenant user could tag an object they
 // are not allowed to read. See shared/parent-visibility.ts.
-export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
+export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS, assignmentExecutor = tagAssignmentExecutor) {
     return {
         name: "assign-tag",
         schema: assignTagPayloadSchema,
@@ -37,11 +37,11 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
             if (denied)
                 return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
-            const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
+            const existing = await assignmentExecutor.detail({ id }, event.user, ctx.db);
             if (existing) {
                 return { isSuccess: true, data: { id } };
             }
-            const restored = await tagAssignmentExecutor.restore({ id }, event.user, ctx.db);
+            const restored = await assignmentExecutor.restore({ id }, event.user, ctx.db);
             if (restored.isSuccess)
                 return { isSuccess: true, data: { id } };
             // A concurrent first-time assign can also land here: the other caller's
@@ -57,7 +57,7 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
             const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
             if (!tag)
                 return writeFailure(new NotFoundError("tag", payload.tagId));
-            const created = await tagAssignmentExecutor.create({
+            const created = await assignmentExecutor.create({
                 id,
                 tagId: payload.tagId,
                 entityType: payload.entityType,

package/dist/tags/handlers/remove-tag.write.d.ts

@@ -1,3 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createRemoveTagHandler(access?: AccessRule): WriteHandlerDef;
+import { tagAssignmentExecutor } from "../executor.js";
+export declare function createRemoveTagHandler(access?: AccessRule, assignmentExecutor?: typeof tagAssignmentExecutor): WriteHandlerDef;
 export declare const removeTagHandler: WriteHandlerDef;

package/dist/tags/handlers/remove-tag.write.js

@@ -10,7 +10,7 @@ import { removeTagPayloadSchema } from "../schemas.js";
 // Host reference: entityType/entityId are client input, so the caller must be
 // able to see the host row before detaching anything from it — see
 // shared/parent-visibility.ts.
-export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
+export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS, assignmentExecutor = tagAssignmentExecutor) {
     return {
         name: "remove-tag",
         schema: removeTagPayloadSchema,
@@ -22,11 +22,11 @@ export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
             if (denied)
                 return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
-            const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
+            const existing = await assignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {
                 return { isSuccess: true, data: { id } };
             }
-            return tagAssignmentExecutor.delete({ id }, event.user, ctx.db);
+            return assignmentExecutor.delete({ id }, event.user, ctx.db);
         },
     };
 }

package/dist/tenant-handover/handlers/claim.write.js

@@ -28,6 +28,7 @@ export function createClaimTenantHandoverHandler(opts = {}) {
         schema: z.object({ token: z.string().min(1), entityType: z.string().min(1) }),
         access: { roles: ["Member", "User", "TenantAdmin", "SystemAdmin"] },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: "the ownership change moves rows OUT of a source tenant this caller has no membership " +
                 "in — the framework's declared cross-tenant operation for try-before-signup, not a " +
                 "per-consumer acknowledgeCrossTenant workaround",
@@ -35,8 +36,7 @@ export function createClaimTenantHandoverHandler(opts = {}) {
         agent: { expose: false },
         rateLimit: { per: "user", limit: 10, windowSeconds: 60 },
         handler: async (event, ctx) => {
-            const db = ctx.db.unsafeRaw("tenant-handover claim: cross-tenant read + ownership write, legitimized by the " +
-                "row-bound grant redeemed below");
+            const db = ctx.db.unsafeRaw();
             const rootLocation = resolveRootAnchorLocation(ctx.registry, db, event.payload.entityType);
             if (!rootLocation)
                 return notTransferable(event.payload.entityType);

package/dist/tenant-lifecycle/feature.js

@@ -74,7 +74,7 @@ export function createTenantLifecycleFeature() {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 await runTenantDestructionSweep({
-                    db: ctx.db.unsafeRaw(RUN_TENANT_DESTRUCTION_REASON), // @cast-boundary db-operator — jobs never run inside a DbTx
+                    db: ctx.db.unsafeRaw(), // @cast-boundary db-operator — jobs never run inside a DbTx
                     registry: ctx.registry,
                     now: T.Now.instant(),
                     log: (message) => ctx.log?.warn(message),

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.js

@@ -15,11 +15,14 @@ export const cancelDestructionWrite = defineWriteHandler({
     access: { roles: ["TenantOwner", "Admin"] },
     description: "Returns a tenant whose destruction was requested back to active and clears the grace period; use it to undo a close-account request while the grace period is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: CANCEL_DESTRUCTION_TENANT_ROW_REASON,
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const row = await fetchOne(ctx.db.unsafeRaw(CANCEL_DESTRUCTION_TENANT_ROW_REASON), tenantTable, { id: tenantId });
+        const row = await fetchOne(ctx.db.unsafeRaw(), tenantTable, {
+            id: tenantId,
+        });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));
         }

package/dist/tenant-lifecycle/handlers/request-destruction.write.js

@@ -19,11 +19,12 @@ export const requestDestructionWrite = defineWriteHandler({
     description: "Puts the caller's own tenant into destroyRequested, starts the compliance-profile grace period after which its data is erased, and revokes every session in the tenant; use it when an account owner asks to close their account.",
     agent: { risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: REQUEST_DESTRUCTION_TENANT_ROW_REASON,
     },
     handler: async (event, ctx) => {
         const tenantId = event.user.tenantId;
-        const runner = ctx.db.unsafeRaw(REQUEST_DESTRUCTION_TENANT_ROW_REASON);
+        const runner = ctx.db.unsafeRaw();
         const row = await fetchOne(runner, tenantTable, { id: tenantId });
         if (!row) {
             return writeFailure(new UnprocessableError("tenant_not_found", { details: { tenantId } }));

package/dist/tier-engine/feature.js

@@ -303,7 +303,7 @@ export function createTierEngineFeature(opts = {}) {
                 const rawDb = ctx.systemDb
                     ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
                     : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw(autoDefaultTierHookReason)
+                        ? ctx.db.unsafeRaw()
                         : undefined;
                 // skip: defensive — inTransaction phase always sets db, but AppContext's
                 // type makes it optional. Throwing would be overreach (lifecycle

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -15,11 +15,12 @@ export const getTenantTierQuery = defineQueryHandler({
     schema: z.object({ tenantId: z.string().min(1) }),
     access: { roles: ["SystemAdmin"] },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: GET_TENANT_TIER_REASON,
     },
     handler: async (query, ctx) => {
         const tenantId = query.payload.tenantId; // @cast-boundary engine-bridge
-        const tdb = createTenantDb(ctx.db.unsafeRaw(GET_TENANT_TIER_REASON), tenantId, "system");
+        const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const row = await fetchOne(tdb, tierAssignmentTable, { tenantId });
         return row ?? null;
     },

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -46,11 +46,12 @@ export function createSetTenantTierWrite(opts = {}) {
         }),
         access: { roles: ["SystemAdmin"] },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: SET_TENANT_TIER_REASON,
         },
         handler: async (event, ctx) => {
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
-            const rawDb = ctx.db.unsafeRaw(SET_TENANT_TIER_REASON);
+            const rawDb = ctx.db.unsafeRaw();
             const tdb = createTenantDb(rawDb, tenantId, "system");
             const systemUser = { ...event.user, tenantId };
             const tier = event.payload.tier;

package/dist/user/handlers/detail.query.js

@@ -6,6 +6,7 @@ import { attachTenantLabels, dbForList } from "./list.query.js";
 // bound to their own tenant's memberships (served by the tenant feature).
 const baseDetail = defineEntityDetailHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     description: "Loads one identity record by id for a SystemAdmin, enriched with the same derived `tenants` membership label as the user list; tenant-level admins do not reach it.",
 });
 // Same tenants enrichment as user:list — derived field placeholder is "".

package/dist/user/handlers/list.query.js

@@ -6,6 +6,7 @@ import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
 import { userEntity } from "../schema/user.js";
 const baseList = defineEntityListHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     description: "Lists identity records across every tenant for a SystemAdmin roster, each row carrying a derived `tenants` label naming the tenants the user belongs to and their roles there.",
 });
 async function loadMemberships(db, userIds) {

package/dist/user-data-rights/feature.js

@@ -411,7 +411,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 // Discriminator wird via handlerName="user-data-rights:run-export-
                 // jobs" im Secret-Read-Audit erfasst.
                 const exportUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const exportDb = ctx.db.unsafeRaw(RUN_EXPORT_JOBS_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const exportDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const exportRegistry = ctx.registry;
                 // JobContext carries ctx.meter (raw), not ctx.metrics — that bound
                 // handle only exists on HandlerContext (built per write/query call
@@ -496,7 +496,7 @@ export function createUserDataRightsFeature(opts = {}) {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 const forgetUserId = ctx._userId ?? SYSTEM_USER_ID;
-                const forgetDb = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON); // @cast-boundary db-operator — jobs never run inside a DbTx
+                const forgetDb = ctx.db.unsafeRaw(); // @cast-boundary db-operator — jobs never run inside a DbTx
                 const forgetRegistry = ctx.registry;
                 const tenantModel = await resolveAppTenantModel({
                     registry: forgetRegistry,

package/dist/user-data-rights/handlers/cancel-deletion.write.js

@@ -27,6 +27,7 @@ export const cancelDeletionWrite = defineWriteHandler({
     },
     description: "Withdraws the calling user's own pending account-deletion request and puts the account back to active, accepted only while the grace period is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw", "globalWrites"],
         reason: APPEND_LIFECYCLE_EVENT_REASON,
     },
     handler: async (event, ctx) => {
@@ -44,7 +45,7 @@ export const cancelDeletionWrite = defineWriteHandler({
         if (!isWithinGracePeriod(row.gracePeriodEnd)) {
             return writeFailure(new UnprocessableError("grace_period_expired"));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), event.user.id, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), event.user.id, {
             status: USER_STATUS.Active,
             gracePeriodEnd: null,
             // #354/1: closes the replay-after-cancel window — a still-TTL-valid email

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -68,7 +68,7 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 secret: opts.deletionTokenSecret,
                 loadPendingRequestId: (userId) => readPendingDeletionRequestId(ctx, userId),
                 commitDeletion: async (userId, requestId) => {
-                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
+                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw(), { pendingDeletionRequestId: requestId });
                     if (!res.ok)
                         return false;
                     gracePeriodEndIso = res.gracePeriodEnd.toString();

package/dist/user-data-rights/handlers/download-attempt-list.query.js

@@ -5,6 +5,7 @@ import { downloadAttemptEntity } from "../schema/download-attempt.js";
 // non-convention QN; entityList needs the convention `download-attempt:list`.
 export const downloadAttemptListQuery = defineEntityListHandler("download-attempt", downloadAttemptEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     escapeHatch: {
         reason: "SystemAdmin DPO triage of invalid export-download attempts needs every tenant's rows to spot brute-force patterns across tenants",
     },

package/dist/user-data-rights/handlers/download-by-job.query.js

@@ -47,6 +47,7 @@ export const downloadByJobQuery = defineQueryHandler({
     }, // openToAll = auth-required, kein anonymous
     description: "Returns a short-lived signed download URL for the calling user's own finished data-export job named by job id, backing the download button in the privacy center once export-status reports the job done.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DOWNLOAD_BY_JOB_REASON,
     },
     handler: async (query, ctx) => {
@@ -60,7 +61,7 @@ export const downloadByJobQuery = defineQueryHandler({
         // Wert (603/2).
         const auditIp = requestContext.get()?.ip ?? null;
         const auditUa = requestContext.get()?.userAgent ?? null;
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_JOB_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1-2: job-lookup + cross-user-isolation
         const jobRow = await fetchOne(runner, exportJobsTable, { id: jobId });
         if (!jobRow || jobRow.userId !== userId) {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -58,12 +58,13 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Memory `feedback_security_default_on`.
     rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DOWNLOAD_BY_TOKEN_REASON,
     },
     handler: async (query, ctx) => {
         const T = getTemporal();
         const now = T.Now.instant();
-        const runner = ctx.db.unsafeRaw(DOWNLOAD_BY_TOKEN_REASON);
+        const runner = ctx.db.unsafeRaw();
         // Step 1: hash + lookup
         const hash = await hashDownloadToken(query.payload.token);
         const tokenRow = await fetchOne(runner, exportDownloadTokensTable, {

package/dist/user-data-rights/handlers/export-status.query.js

@@ -26,10 +26,11 @@ export const exportStatusQuery = defineQueryHandler({
     },
     description: "Returns the calling user's own most recent data-export job with its status, expiry and error, or hasJob false, for polling after a request-export while the job is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: EXPORT_STATUS_REASON,
     },
     handler: async (query, ctx) => {
-        const rows = await selectMany(ctx.db.unsafeRaw(EXPORT_STATUS_REASON), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
+        const rows = await selectMany(ctx.db.unsafeRaw(), exportJobsTable, { userId: query.user.id }, { limit: 1, orderBy: { col: "requestedAt", direction: "desc" } });
         const latest = rows[0];
         if (!latest)
             return { hasJob: false };

package/dist/user-data-rights/handlers/lift-restriction.write.js

@@ -5,8 +5,6 @@ import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 const LIFT_RESTRICTION_ESCAPE_HATCH_REASON = "checks the target user's membership in the admin's tenant and appends the user lifecycle status change on the SYSTEM_TENANT_ID user stream, both via DbRunner helpers outside the admin's own tenant scope.";
-const CHECK_TARGET_MEMBERSHIP_REASON = "checks the target user's membership in the admin's tenant via the DbRunner helper";
-const APPEND_LIFECYCLE_EVENT_REASON = "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
 //
 // Operator-only. A Restricted user's own session is unconditionally
@@ -33,11 +31,12 @@ export const liftRestrictionWrite = defineWriteHandler({
     access: { roles: access.admin },
     description: "Lifts a GDPR Art. 18 processing restriction on the named user and returns the account to active; operator-only, because a restricted user's own session is rejected and cannot reach this endpoint.",
     escapeHatch: {
+        grants: ["unsafeRaw", "globalWrites"],
         reason: LIFT_RESTRICTION_ESCAPE_HATCH_REASON,
     },
     handler: async (event, ctx) => {
         const targetUserId = event.payload.userId;
-        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(CHECK_TARGET_MEMBERSHIP_REASON), event.user, targetUserId);
+        const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
         if (outside)
             return outside;
         const userRow = await ctx.db.global(userTable).fetchOne({
@@ -54,7 +53,7 @@ export const liftRestrictionWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), targetUserId, {
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, {
             status: USER_STATUS.Active,
         });
         return {

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -33,6 +33,7 @@ export const myAuditLogQuery = defineQueryHandler({
     },
     description: "Returns the calling user's own event-store entries across all their tenant memberships, paged and filterable by aggregate type, event type and time range, for the GDPR Art. 15 self-disclosure; it can never read another user's history.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: MY_AUDIT_LOG_REASON,
     },
     handler: async (query, ctx) => {
@@ -52,7 +53,7 @@ export const myAuditLogQuery = defineQueryHandler({
         }
         if (p.before)
             where["id"] = { lt: BigInt(p.before) };
-        const rows = await selectMany(ctx.db.unsafeRaw(MY_AUDIT_LOG_REASON), eventsTable, where, {
+        const rows = await selectMany(ctx.db.unsafeRaw(), eventsTable, where, {
             orderBy: { col: "id", direction: "desc" },
             limit: p.limit,
         });

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -36,6 +36,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["unsafeRaw", "globalWrites"],
             reason: APPEND_LIFECYCLE_EVENT_REASON,
         },
         handler: async (event, ctx) => {
@@ -56,7 +57,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
             // user-Row landet und in die Token-HMAC-Purpose gefaltet wird. cancel
             // nullt sie → ein nach Cancel nachgespieltes Token verifiziert nicht mehr.
             const requestId = crypto.randomUUID();
-            await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), userRow["id"], {
+            await updateUserLifecycle(ctx.db.unsafeRaw(), userRow["id"], {
                 pendingDeletionRequestId: requestId,
             });
             const { token, expiresAt } = signDeletionToken(userRow["id"], requestId, DELETION_VERIFY_TTL_MINUTES, opts.deletionTokenSecret);

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -29,7 +29,7 @@ export function createRequestDeletionHandler(opts = {}) {
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
-            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
+            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw());
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;

package/dist/user-data-rights/handlers/request-export.write.js

@@ -51,13 +51,14 @@ export const requestExportWrite = defineWriteHandler({
     },
     description: "Queues a GDPR Art. 15 and 20 data export for the calling user and returns its job id, handing back the running job with isExisting true instead of a second one when an export is already pending.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: REQUEST_EXPORT_REASON,
     },
     handler: async (event, ctx) => {
         const userId = event.user.id;
         const T = getTemporal();
         const now = T.Now.instant();
-        const exportJobRunner = ctx.db.unsafeRaw(REQUEST_EXPORT_REASON);
+        const exportJobRunner = ctx.db.unsafeRaw();
         // Pre-Check: exportJobRunner bypasses the TenantDb-Filter — the
         // TenantDb-Wrapper would hide cross-tenant jobs.
         const existing = await findActiveJob(exportJobRunner, userId);

package/dist/user-data-rights/handlers/restrict-account.write.js

@@ -59,7 +59,7 @@ export const restrictAccountWrite = defineWriteHandler({
                     details: { reason: "admin_required_for_other_user" },
                 }));
             }
-            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw("checks the target user's membership in the admin's tenant via the DbRunner helper"), event.user, targetUserId);
+            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
             if (outside)
                 return outside;
         }
@@ -82,7 +82,7 @@ export const restrictAccountWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), targetUserId, { status: USER_STATUS.Restricted });
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, { status: USER_STATUS.Restricted });
         // Cross-Feature: alle live sessions revoken — sonst koennte der User
         // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
         // ctx.writeAs(systemUser, ...) damit der privileged-Handler die

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -26,6 +26,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
         // records without softDelete — an agent must never be able to trigger it.
         agent: { expose: false, risk: "high" },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: RUN_FORGET_CLEANUP_REASON,
         },
         handler: async (_event, ctx) => {
@@ -35,7 +36,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
                 }));
             }
             const T = getTemporal();
-            const runner = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON);
+            const runner = ctx.db.unsafeRaw();
             // Operator-triggered forget must also erase binaries, not just rows —
             // it flips users to Deleted, after which the cron never re-processes
             // them, so a row-only delete here would permanently leak the binaries.

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -18,7 +18,7 @@ import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
 // NICHT `event.user.tenantId` (das ist der aktive Tenant zur Lifecycle-Zeit und
 // kann abweichen).
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-// `conn` is ctx.db.unsafeRaw(reason) (regular handlers) or the open tx
+// `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
 // (forget-cleanup sub-tx) — keeps the event append atomic with the write.
 //
 // Returns `{ applied: false }` instead of throwing only when `options.expect`

package/dist/user-data-rights/run-forget-cleanup.js

@@ -1,11 +1,13 @@
 // Forget-Cleanup-Runner (S2.U5b) — pure-Function Pipeline.
 //
-// Nach abgelaufener Grace-Period (S2.U5a setzt gracePeriodEnd) iteriert
-// dieser Runner ueber alle User in DeletionRequested-State und triggert
-// die EXT_USER_DATA-delete-Hooks pro Membership-Tenant.
+// After the grace period (S2.U5a sets gracePeriodEnd) this runner iterates
+// over all users in DeletionRequested state and triggers the EXT_USER_DATA
+// delete hooks in every tenant the user is or was a member of (membership
+// history from kumiko_events).
 //
-// **Cross-Tenant-Iteration:** Ein User-Forget-Antrag in Tenant A muss
-// die Daten des Users in ALLEN seinen Tenants entfernen — siehe
+// **Cross-tenant iteration:** a forget request in tenant A must remove the
+// user's data in ALL of their tenants, including tenants they left before
+// the request — see
 // docs/plans/architecture/user-data-rights.md "Cross-Tenant-Semantik".
 //
 // **Strategy-Dispatch:** Pro Entity entscheidet die data-retention-
@@ -177,15 +179,16 @@ async function processUser(args) {
     // memberships in der Tx loeschen. Orphan-User (0 memberships) liefert
     // [] in Email-args; App-Author-Template kann das case-handlen.
     const tenantIdsBeforeDelete = memberships.map((m) => m.tenantId);
-    // Edge-Case "0 Memberships": User hat alle Tenants schon verlassen
-    // bevor Forget triggerte. Wir laufen den Hook-Loop trotzdem mit einem
-    // Pseudo-Tenant — der user-Hook (user-data-rights-defaults) ist
-    // tenant-agnostisch und MUSS laufen damit email/displayName/passwordHash
-    // anonymisiert werden. Tenant-scoped Hooks (z.B. fileRefDeleteHook)
-    // finden im Pseudo-Tenant nichts und sind no-op. Ohne diesen Pfad
-    // wuerde status=Deleted gesetzt waehrend Original-PII liegen bleibt
-    // — sieht compliant aus, ist es nicht (advisor-Finding S2.U5b.fix1).
-    const tenantList = memberships.length > 0 ? memberships.map((m) => m.tenantId) : [SYSTEM_TENANT_ID_FOR_ORPHANS];
+    // Departed tenants: removeMember deletes only the projection row, so data
+    // the user left behind there (e.g. note mentions) must still be reached.
+    const historicalTenantIds = await readHistoricalMembershipTenantIds(db, userId);
+    const hookTenantIds = [...new Set([...tenantIdsBeforeDelete, ...historicalTenantIds])];
+    // Edge case "0 tenants" (neither membership nor history): the hook loop still
+    // runs with a pseudo tenant. The user hook is tenant-agnostic and MUST run so
+    // email/displayName/passwordHash get anonymized; tenant-scoped hooks find
+    // nothing there and no-op. Without this path status=Deleted would be set
+    // while the original PII stays — compliant-looking, but not compliant.
+    const tenantList = hookTenantIds.length > 0 ? hookTenantIds : [SYSTEM_TENANT_ID_FOR_ORPHANS];
     // Per-User-Sub-Tx: hooks + status-flip atomar. Bei Hook-Throw rollt
     // nur dieser User zurueck, andere User bleiben commit-fest. Die Sub-Tx
     // nestet korrekt: eine Top-Level-Connection oeffnet sie via `.begin`
@@ -342,7 +345,7 @@ async function resolveEffectiveTenantModel(db, tenantId, appTenantModel) {
 // rows.
 //
 // Filter by payload->>'tenantId' (not the event column tenant_id): cross-
-// tenant SystemAdmin adds land under the actor's tenant_id (#2347).
+// tenant SystemAdmin adds land under the actor's tenant_id.
 //
 // Counting created-ROWS against distinct userIds latched a tenant to
 // multi-user as soon as its sole member was removed and re-added (#2608) —
@@ -369,6 +372,18 @@ async function everHadMultipleMembers(db, tenantId) {
     // could name a second member.
     return row.event_count > row.readable_users;
 }
+// Filter by payload (not the event column tenant_id) for the same reason as
+// everHadMultipleMembers: cross-tenant SystemAdmin adds are billed to the
+// actor's tenant.
+async function readHistoricalMembershipTenantIds(db, userId) {
+    const rows = await executeRawQuery(db, `SELECT DISTINCT payload->>'tenantId' AS tenant_id
+     FROM kumiko_events
+     WHERE aggregate_type = 'tenant-membership'
+       AND type = $1
+       AND payload->>'userId' = $2
+       AND NULLIF(payload->>'tenantId', '') IS NOT NULL`, [entityEventName("tenant-membership", "created"), userId]);
+    return rows.map((row) => row.tenant_id); // @cast-boundary db-row
+}
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.
 //   - "anonymize" / "blockDelete" → "anonymize" (Aufbewahrungs-Pflicht
 //     blockDelete: Daten muessen physisch bleiben, nur Personen-Bezug raus)

package/dist/workflow-runner/event-subscriber.js

@@ -20,7 +20,7 @@
 // This subscriber never resumes a run itself (D3, workflow-resume-loop.md):
 // the MultiStreamApplyContext it runs in has no callFeature/runStepList
 // access, only unsafeAppendEvent/loadAggregate. It writes triggerEventType
-// + triggerPayload + wakeAt=now() onto the matching pending row(s); the
+// + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -66,7 +66,11 @@ const wakeupApply = async (event, tx) => {
             continue;
         await updateMany(tx, workflowRunPendingTable, {
             triggerEventType: event.type,
-            triggerPayload: event.payload,
+            triggerEventRef: {
+                eventId: event.id,
+                aggregateId: event.aggregateId,
+                version: event.version,
+            },
             wakeAt: getTemporal().Now.instant().toString(),
         }, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
     }

package/dist/workflow-runner/event-trigger.js

@@ -69,6 +69,11 @@ export function registerEventTrigger(r, workflow) {
                         runId,
                         workflow,
                         triggerEvent,
+                        triggerEventRef: {
+                            eventId: event.id,
+                            aggregateId: event.aggregateId,
+                            version: event.version,
+                        },
                         ...(idempotencyKey && { idempotencyKey }),
                         // @cast-boundary msp-to-handler-ctx — MultiStreamApplyContext only
                         // exposes unsafeAppendEvent/loadAggregate, a subset of